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Abstract 

After carrying out a protocol for quantum key agreement over a noisy 
quantum channel, the parties Alice and Bob must process the raw key 
in order to end up with identical keys about which the adversary has 
virtually no information. In principle, both classical and quantum pro- 
tocols can be used for this processing. It is a natural question which 
type of protocols is more powerful. We show that in many cases, for 
instance when the 4-state or the 6-state protocol is used, the limits 
of tolerable noise are identical for classical and quantum protocols. 
More precisely, we prove for general states but under the assumption 
of incoherent eavesdropping that Alice and Bob share some so-called 
intrinsic information in their classical random variables, resulting from 
optimal measurements, if and only if the parties' quantum systems are 
entangled. In addition, we provide evidence which strongly suggests 
that the potentials of classical and of quantum protocols are equal in 
every situation. It is an important consequence of these parallels that 
many techniques and results from quantum information theory directly 
apply to problems in classical information theory, and vice versa. For 
instance, it was previously believed that two parties can carry out un- 
conditionally secure key agreement as long as they share some intrinsic 
information in the adversary's view. The analysis of this purely classi- 
cal problem from the quantum information-theoretic viewpoint shows 
that this is true in the binary case, but false in general. More explicitly, 
bound entanglement, i.e., entanglement that cannot be purihcd by any 
quantum protocol, has a classical counterpart. This "bound intrinsic 
information" cannot be distilled to a secret key by any classical pro- 
tocol. As another application we propose a measure for entanglement 
based on classical information-theoretic quantities. 
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1 Introduction 

In modern cryptography there are mainly two security paradigms, namely 
computational and information-theoretic security. The latter is sometimes 
also called unconditional security. Computational security is based on the as- 
sumed hardness of certain computational problems (e.g., the integer-factoring 
or discrete- logarithm problems). However, since a computationally suf- 
ficiently powerful adversary can solve any computational problem, hence 
break any such system, and because no useful general lower bounds are 
known in complexity theory, computational security is always conditional 
and, in addition to this, in danger by progress in the theory of efficient 
algorithms as well as in hardware engineering (e.g., quantum computing). 
Information-theoretic security on the other hand is based on probability 
theory and on the fact that an adversary's information is limited. Such a 
limitation can for instance come from noise in communication channels or 
from the laws of quantum mechanics. 

Many different settings in the classical noisy-channel model have been 



described and analyzed, such as Wyner's wire-tap channel [29|, Csiszar and 
Korner's broadcast channel [Q], or Maurer's key agreement from joint ran- 
domness p|, p2|. 



Quantum cryptography on the other hand lies in the intersection of two 
of the major scientific achievements of the 20th century, namely quantum 
physics and information theory. Various protocols for so-called quantum 
key agreement have been proposed (e.g., ||, |l0|1), and the possibility and 
impossibility of purification in different settings has been studied by many 
authors. 

The goal of this paper is to derive parallels between classical and quan- 
tum key agreement and thus to show that the two paradigms are more 
closely related than previously recognized. These connections allow for in- 
vestigating questions and solving open problems of purely classical infor- 
mation theory with quantum-mechanic methods. One of the consequences 
is that, in contrast to what was previously believed, there exists a classical 
counterpart to so-called bound entanglement (i.e., entanglement that cannot 
be purified by any quantum protocol), namely intrinsic information shared 
by Alice and Bob which they cannot use for generating a secret key by any 
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classical protocol. 

The outline of the paper is as follows. In Section [2| we introduce the 



classical (Section |2.1|) and quantum (Section 2.2) models of information- 
theoretic key agreement and the crucial concepts and quantities, such as 
secret-key rate and intrinsic information on one side, and measurements, 
entanglement, and quantum privacy amplification on the other. In Sec- 
tion ^, we show the mentioned links between these two models, more pre- 
cisely, between entanglement and intrinsic information (Section as well 
as between quantum purification and the secret-key rate (Section |3.4|). We 
illustrate the statements and their consequences with a number of exam- 



ples (Sections [O] and |3J3] and Appendix B). In Section ^ we define and 
characterize the classical counterpart of bound entanglement, called bound 
intrinsic information. Finally we show that not only problems in classical 
information theory can be addressed by quantum-mechanical methods, but 
that the inverse is also true: In Section [T^ we propose a new measure for 
entanglement based on the intrinsic information measure. 



2 Models of Information- Theoretically Secure Key 
Agreement 

2.1 Key Agreement from Classical Information: Intrinsic In- 
formation and Secret-Key Rate 

In this section we describe Maurer's general model of classical key agreement 
by public discussion from common information pp| . In this setting, two 
parties Alice and Bob who are willing to generate a secret key have access 
to repeated independent realizations of (classical) random variables X and 
Y, respectively, whereas an adversary Eve learns the outcomes of a random 
variable Z. Let Pxyz be the joint distribution of the three random variables. 
In addition, Alice and Bob are connected by a noiseless and authentic but 
otherwise completely insecure channel (see Figure [l] in Appendix A). In this 
situation, the secret-key rate S^X; y| |Z) has been defined as the maximal 
rate at which Alice and Bob can generate a secret key that is equal for Alice 
and Bob with overwhelming probability and about which Eve has only a 
negligible amount of (Shannon) information. For a detailed discussion of 
the general scenario and the secret-key rate as well as for various bounds on 
S(X;Y\\Z),see^}, [ 

Bound (H) implies that if Bob's random variable Y provides more in- 
formation about Alice's X than Eve's Z does (or vice versa), then this 



21], 
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advantage can be exploited for generating a secret key: 



S(X; Y\\Z) > max {I(X; Y) - I(X; Z) , I(Y; X) - I(Y; Z)} . (1) 

This is a consequence of a result by Csiszar and Korner |7]] . It is somewhat 
surprising that this bound is not tight, in particular, that secret-key agree- 
ment can even be possible when the right-hand side of (|T|) vanishes or is 
negative. However, the positivity of the expression on the right-hand side 
of (||) is a necessary and sufficient condition for the possibility of secret- 
key agreement by one-way communication: whenever Alice and Bob start 
in a disadvantageous situation with respect to Eve, feedback is necessary. 
The corresponding initial phase of the key-agreement protocol is then often 
called advantage distillation. 

The following upper bound on S^-X"; Y||Z) is a generalization of Shan- 



non's well-known impracticality theorem [28] and quantifies the intuitive 
fact that no information-theoretically secure key agreement is possible when 
Bob's information is independent from Alice's random variable, given Eve's 
information: < I(X;Y\Z). However, this bound is not tight. 

Because it is a possible strategy of the adversary Eve to process Z, i.e., to 
send Z over some channel characterized by -Pgj^, we have for such a new 
random variable Z that S^X; Y||Z) < I(X;Y\Z), and hence 



S(X;Y\\Z) < min P - z {I(X;Y\Z)} =: I{X-Y[Z) 



(2) 



holds. The quantity I(X;Y j Z) has been called the intrinsic conditional 
information between X and Y given Z [^]. It was conjectured, and evidence 
supporting this belief was given, that S(X;Y\\Z) > holds if I(X; Y[Z) > 



does |22|] . Some of the results below strongly suggest that this is true if one of 
the random variables X and Y is binary and the other one at most ternary, 
but false in general. 



2.2 Quantum Key Agreement: Measurements, Entanglement, 
Purification 

We assume that the reader is familiar with the basic quantum-theoretic 
concepts and notations. For an introduction, see for example p4f . 

In the context of quantum key agreement, the classical scenario Pxyz 
is replaced by a quantum state vector \E' £ TLa ^'Hb® 'Hb^ where Ha, 

We consider pure states, since it is natural to assume that Eve controls all the envi- 
ronment outside Alice and Bob's systems. 
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TCb, and He are Hilbert spaces describing the systems in Alice's, Bob's, 
and Eve's hands, respectively. Then, measuring this quantum state by the 
three parties leads to a classical probability distribution. In the following, 
we assume that Eve is free to carry out so-called generalized measurements 
(POVMs) |24|] . In other words, the set {\z)} will not be assumed to be 
an orthonormal basis, but any set generating the Hilbert space He and 
satisfying the condition ^ \z){z\ = 1-h e . Then, if the three parties carry 
out measurements in certain basest] {\x)} and {|y)}, and in the set {\z)}, 
respectively, they end up with the classical scenario Pxyz = \(x,y, z\^}\ 2 . 
Since this distribution depends on the chosen bases and set, a given quantum 
state ^ does not uniquely determine a classical scenario: some measurements 
may lead to scenarios useful for Alice and Bob, whereas for Eve, some others 
may (see Appendix B). 

The analog of Alice and Bob's marginal distribution Pxy is the partial 
state pABi obtained by tracing over Eve's Hilbert space He- More precisely, 
let ^ = Ylxyz c xyz\x, y, z) , where \x, y, z) is short for \x) ® \y) ® \z). We can 
write ^ = ^2 Z \J Pz(z)ip z ® \ z )-> where Pz denotes Eve's marginal distribu- 
tion of Pxyz- Then p AB = Tr nE (P^,) := Y,z P z{z)Pi, z , where P$ z is the 
projector to the state vector ip z . 

An important property is that pab is pure {p\ B = Pab) if and only if 
the global state ^ factorizes, i.e., \& = i^ab ® tpE, where ipAB £ Ha ® Hb 
and ipE 6 He- In this case Alice and Bob are independent of Eve: Eve 
cannot obtain any information on Alice's and Bob's states by measuring her 
system. 

After a measurement, Alice and Bob obtain a classical distribution Pxy- 
However, in order to obtain a well-defined classical scenario one has to as- 
sume that also Eve performs a measurement, i.e., that Eve treats her in- 
formation on the classical level. Indeed, only then a classical distribution 
Pxyz is defined. But considering that in practice all Pxyz result from some 
physical process, the assumption that Eve performs the measurement one 
would like her to perform is not founded on basic principles^]. For example, 
Eve's measurement could be done later and depend on the public discussion 
between Alice and Bob. Consequently, the common approach which starts 
from Pxyz to prove the security of a key agreement protocol hides an as- 
sumption about Eve's measurement. As we shall see, avoiding this hidden 

2 We assume all bases to be orthonormal. 

3 One could argue that if the system in Eve's hand is classical, then she has no choice for 
her measurement. But ultimately all systems are quantum mechanical and the apparent 
lack of choice might purely be a matter of technology. 



5 



assumption and staying in the quantum regime can actually simplify the 
analysis of the scenario. 

When Alice and Bob share many independent systems^ pab-, there are 
basically two possibilities for generating a secret key. Either they first mea- 
sure their systems and then run a classical protocol (process classical infor- 
mation) secure against all measurements Eve could possibly perform (i.e., 
against all possible distributions Pxyz that can result after Eve's measure- 
ment). Or they first run a quantum protocol (i.e., process the information 
in the quantum domain) and then perform their measurements. The idea 
of quantum protocols is to process the systems in state pab and to produce 
fewer systems in a pure state (i.e., to purify pab), thus to eliminate Eve from 
the scenario. Moreover, the pure state Alice and Bob end up with should 
be maximally entangled (i.e., even for some different and incompatible mea- 
surements, Alice's and Bob's results are perfectly correlated). Finally, Alice 
and Bob measure their maximally entangled systems and establish a secret 
key. This way of obtaining a key directly from a quantum state \&, without 
any error correction nor classical privacy amplification, is called quantum 
privacy amplification^ (QPA for short) Q, |^]. Note that the procedure 
described in |8| and [Q] guarantees that Eve's relative information (relative 
to the key length) is arbitrarily small, but not that her absolute information 
is negligible. The analog of this problem in the classical case is discussed 
in |2l . 

The precise conditions under which a general state pab can be purified 
are not known. However, the two following conditions are necessary. First, 
the state must be entangled or, equivalently, not separable. A state pab is 
separable if and only if it can be written as a mixture of product states, i.e., 
Pab = ^ZjPjPAj® pBj- Separable states can be generated by purely classical 
communication, hence it follows from bound (^) that entanglement is a 
necessary condition. The second condition is more subtle: The matrix p\ B 
obtained from pab by partial transposition must have at least one negative 
eigenvalue |l71] , |16[| . The partial transposition of the density matrix pab 
is defined as {pab)\ j-^v '■= (pAB)i,u-,fi,j, where the indices i and p [j and v] 
run through a basis of Ha \Hb\- Note that this definition is base-dependent. 
However, the eigenvalues of p l AB are not pfi[| . The second of these conditions 

4 Here we do not consider the possibility that Eve coherently processes several of her 
systems. This corresponds to the assumption in the classical scenario that repeated real- 
izations of X, Y, and Z are independent of each other. 

5 The term "quantum privacy amplification" is somewhat unfortunate since it does not 
correspond to classical privacy amplification, but includes advantage distillation and error 
correction. 
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implies the first one: negative (i.e., at least one eigenvalue is negative) partial 
transposition implies entanglement. 

In the binary case (Ha and TL b both have dimension two) , the above two 
conditions are equivalent and sufficient for the possibility of quantum key 
agreement: all entangled binary states can be purified. The same even holds 
if one Hilbert space is of dimension 2 and the other one of dimension 3. How- 
ever, for larger dimensions there are examples showing that these conditions 
are not equivalent: There are entangled states whose partial transpose has 
no negative eigenvalue, hence cannot be purified [17|. Such states are called 
bound entangled, in contrast to free entangled states, which can be purified. 
Moreover, it is believed that there even exist entangled states which cannot 
be purified although they have negative partial transposition M. 



3 Linking Classical and Quantum Key Agreement 

In this section we derive a close connection between the possibilities offered 
by classical and quantum protocols for key agreement. The intuition is as 
follows. As described in Section [E^, there is a very natural connection 
between quantum states and classical distributions Pxyz which can be 
thought of as arising from ^ by measuring in a certain basis, e.g., the stan- 
dard basis0. (Note however that the connection is not unique even for fixed 
bases: For a given distribution Pxyz, there are many states ^ leading to 
Pxyz by carrying out measurements.) When given a state \& between three 
parties Alice, Bob, and Eve, and if pab denotes the resulting mixed state 
after tracing out Eve, then the corresponding classical distribution Pxyz 
has positive intrinsic information if and only if pab is entangled. However, 
this correspondence clearly depends on the measurement bases used by Al- 
ice, Bob, and Eve. If for instance pab is entangled, but Alice and Bob 
do very unclever measurements, then the intrinsic information may vanish 
(see Example 7 in Appendix B). If on the other hand pab is separable, 
Eve may do such bad measurements that the intrinsic information becomes 
positive, despite the fact that pab could have been established by public 
discussion without any prior correlation (see Example 6 in Appendix B). 
Consequently, the correspondence between intrinsic information and entan- 

6 A priori, there is no privileged basis. However, physicists often write states like pab in 
a basis which seems to be more natural than others. We refer to this as the standard basis. 
Somewhat surprisingly, this basis is generally easy to identify, though not precisely defined. 
One could characterize the standard basis as the basis for which as many coefficients as 
possible of 9 are real and positive. We usually represent quantum states with respect to 
the standard basis. 
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glement must involve some optimization over all possible measurements on 
all sides. 

A similar correspondence on the protocol level is supported by many 
examples, but not rigorously proven: The distribution Pxyz allows for clas- 
sical key agreement if and only if quantum key agreement is possible starting 
from the state pab- 

We show how these parallels allow for addressing problems of purely clas- 
sical information-theoretic nature with the methods of quantum information 
theory, and vice versa. 



3.1 Entanglement and Intrinsic Information 

Let us first establish the connection between intrinsic information and en- 
tanglement. Theorem |l| states that if pab is separable, then Eve can "force" 
the information between Alice's and Bob's classical random variables (given 
Eve's classical random variable) to be zero (whatever strategy Alice and Bob 
use). In particular, Eve can prevent classical key agreement. 

Theorem 1 Let ^ G Ha ® <8> He and pab = Tr« B (-P*)- If pab is 
separable, then there exists a generating set {\z)} of He such that for all 
bases {\x}} and {\y}} ofHj^ and Hb, respectively, I(X;Y\Z) = holds for 
PxYz(x,y,z) := \{x,y,z\^)\ 2 . 

Proof. If pab is separable, then there exist vectors \a z ) and \(3 Z ) such that 
Pab = YTz=\VzPa z ®Pf3 z , where P az denotes the one-dimensional projector 
onto the subspace spanned by \a z ). 

Let us first assume that n z < dim?^. Then there exists a basis {\z)} 
of He such that ^ = zZ z JK\oc z ^ z ,z) holds pi] , @], M 



If n z > dimHEi then Eve can add an auxiliary system H aU x to hers 
(usually called an ancilla) and we have \l/(g) I70) = ^2 Z ^Jp~ z \a z , (3 Z , j z ), where 
I70) £ Haux is the state of Eve's auxiliary system, and {(7^)} is a basis of 
He® Haux- We define the (not necessarily orthonormalized) vectors \z) by 
I z, 70) = l-n E ®P* 10 \'y z ). These vectors determine a generalized measurement 
with positive operators O z = \z){z\. Since O z (g> P 70 = \z, 70) (2, 70 1 = 
Ez 1 H B ® P io\lz){\lz\^H E ®P-i = ^H E ®P 10 , the O z satisfy Y. z °z = &H E , 
as they should in order to define a generalized measurement . Note that 
the first case (n z < dimHE) is a special case of the second one, with \ j z ) = 
\z, 70). If Eve now performs the measurement, then we have Pxyz( x , z ) = 
\{x,y,z\^)\ 2 = |(x,y,7 z |^,7o)| 2 , and 

PxY\z(x,y,z) = \(x,y\a z ,(3 z }\ 2 = \ (x\a z }\ 2 \(y\P z }\ 2 = P x \z{x, z)P Y \z{y, z) 
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holds for all \z) and for all \x,y) £ Ha'&'Hb- Consequently, I(X;Y\Z) = 0. 

□ 

Theorem ^ states that if pab is entangled, then Eve cannot force the 
intrinsic information to be zero: Whatever she does (i.e., whatever general- 
ized measurements she carries out), there is something Alice and Bob can 
do such that the intrinsic information is positive. Note that this does not, 
a priori, imply that secret-key agreement is possible in every case. Indeed, 
we will provide evidence for the fact that this implication does generally not 
hold. 

Theorem 2 Let ^ G Ha ® <8> He and pab = Tr^ B (P^). If pab is 
entangled, then for all generating sets {\z)} ofHs, there are bases {\x)} 
and {\y)} of Ha and Hb, respectively, such that I(X;Y J, Z) > holds for 
P X Yz(x,y,z) := \{x,y,z\^)\ 2 . 

Proof. We prove this by contradiction. Assume that there exists a generating 
set {\z)} o(He such that for all bases of Ha and {\y)} o(Hb, I(X; Y j 
Z) = holds for the resulting distribution. For such a distribution, there 
exists a channel, characterized by -Pgj^, such that I(X; Y\Z) = holds, i.e., 

P xy \z( x > V' = P x\z( x > z) P Y\z(y> 2 ) • ( 3 ) 

Let nowpj := {l/pz) J2 z Pz p z\z(z, z)P^, z withp^ = Pz{z) andpz = ^ z P^ z {z,z)p z , 
and where ip z is the state of Alice's and Bob's system conditioned on Eve's 
result z: ^ (g> I70) = Yl z ^ ® Viz) ( see ^ ne P r °of of Theorem 1). 

From (g) we can conclude Tr(P x <g> P y pi) = Tr(P x (g> tp z ) Tr(l tg> P y pi) 
for all one-dimensional projectors P x and P y acting in Ha and Hb, respec- 
tively. Consequently, the states pz are products, i.e., pz = p a - p^, and 
PAB = Y2z PzPz is separable. □ 

Theorem [| can be formulated in a more positive way. Let us first intro- 
duce the concept of a set of bases {\x J ), {y-*)}, where the j label the different 
bases, as they are used in the 4-state (2 bases) and the 6-state (3 bases) pro- 
tocols ||, pj. Then if pab is entangled there exists a set { | x J ), | of N 
bases such that for all generalized measurements {|^)}, I(X;Y j [Z,j]) > 
holds. The idea is that Alice and Bob randomly choose a basis and, after 
the transmission, publicly restrict to the (possibly few) cases where they 
happen to have chosen the same basis. Hence Eve knows j, and one has 
I{X;Y | [Z,j]) = (l/N)J2f =1 I{ xj ; Yj I Z) . If the set of bases is large 
enough, then for all {\z)} there is a basis with positive intrinsic information, 
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hence the mean is also positive. Clearly, this result is stronger if the set 
of bases is small. Nothing is proven about the achievable size of such sets 
of bases, but it is conceivable that max{dim'H y 4, dim?^} bases are always 
sufficient. 

Corollary 3 Let ^ E H A <8> H B <8> H E and pab = Tr Wjs (P^). Then the 
following statements are equivalent: 

(i) PAB is entangled, 

(ii) for all generating sets {\z}} of He, there exist bases {\x}} of Ha and 
{\y}} ofHs such that the distribution PxYz(x,y, z) := | (x, y, z\^}\ 2 satisfies 
I(X;YIZ)>0, 

(ii) for all generating sets {\z}} of He, there exist bases {\x}} of Ha and 
{\y)} ofHs such that the distribution PxYz{x,y, z) := \(x,y, z\^)\ 2 satisfies 
I(X;Y\Z)>0. 

A first consequence of the fact that Corollary || often holds with respect 
to the standard bases (see below) is that it yields, at least in the binary case, 
a criterion for I(X; Y { Z) > that is efficiently verifiable since it is based 
on the positivity of the eigenvalues of a 4 x 4 matrix (see also Example 5). 
Previously, the quantity I(X; Y[Z) has been considered to be quite hard to 
handle. 



3.2 Examples I 

The following examples illustrate the correspondence established in Sec- 



tion 3.1. They show in particular that very often (Examples 1, 2, and 3), 
but not always (Examples 6 and 7 in Appendix B), the direct connection 
between entanglement and positive intrinsic information holds with respect 
to the standard bases (i.e., the bases physicists use by commodity and intu- 
ition). 



Example 1. Let us consider the so-called 4-state protocol of 0. The analy- 
sis of the 6-state protocol [[jj is analogous and leads to similar results p~5| ] . 
We compare the possibility of quantum and classical key agreement given 
the quantum state and the corresponding classical distribution, respectively, 
arising from this protocol. The conclusion is, under the assumption of in- 
coherent eavesdropping, that key agreement in one setting is possible if and 
only if this is true also for the other. 

After carrying out the 4-state protocol, and under the assumption of op- 
timal eavesdropping (in terms of Shannon information) , the resulting quan- 
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turn state is 111 



* = /^|o,o)^oo+/^|oa)®eoi+v / W2|i>o)^io+7i72|i,i)®en e c 2 ®c 

where D (the disturbance) is the probability that 1/7 holds if X and 
Y are the classical random variables of Alice and Bob, respectively, where 
F = 1 — D (the fidelity), and where the £jj satisfy (£oo|£n) = (£qi|£io) = 
1 — 2D and (CiilCii) = f° r an * 7^ 3- Then the state pab is (in the basis 
{| 00 >,| 01 >,| 10 >,| 11 



2, 



Pab 






D)(l - 2D) 
1 -D 





and its partial transpose 

/ D 



t _ 1 



1-D 
-D(l-2£)) 
V-(1-D)(1-2D) 




has the eigenvalues (1/2)(D±(1-D)(1-2D)) and (1/2)((1-D)±D(1-2D)), 
which are all non-negative (i.e., is separable) if 

D>l-±. (4) 

Prom the classical viewpoint, the corresponding distributions (arising 
from measuring the above quantum system in the standard bases) are as 
follows. First, X and Y are both symmetric bits with Prob [I / y] = D. 
Eve's random variable Z = [Z±, Z2] is composed of 2 bits Z\ and Z2, where 
Z\ = X © Y, i.e., Z\ tells Eve whether Bob received the qubit disturbed 
{Z\ = 1) or not [Z\ = 0) (this is a consequence of the fact that the and 
iij (} j) states generate orthogonal sub-spaces), and where the probability 
that Eve's second bit indicates the correct value of Bob's bit is Prob[Z2 = 
Y) = 6 = (1 + V 71 - (£oo|6i> 2 )/2 = 1/2 + y/D{l - D). We now prove that 
for this distribution, the intrinsic information is zero if and only if 

D 



1 - D 



> 2y/(l - 5)5 = 1 - 2D (5) 



holds. We show that if the condition (|5|) is satisfied, then I(X;Y I Z) = 
holds. The inverse implication follows from the existence of a key-agreement 



protocol in all other cases (see Example 1 (cont'd) in Section 3.5). If 
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holds, we can construct a random variable Z, that is generated by sending 
Z over a channel characterized by -Pgj^, for which I(X; Y\Z) = holds. We 
can restrict ourselves to the case of equality in (JsJ) because Eve can always 
increase 5 by adding noise. 

Consider now the channel characterized by the following distribution 
P-z lz (where Z = {u,v}): P^ z (u, [0, 0]) = P^ z (v, [0, 1]) = 1, P^ z (l, [1, 0]) = 
P~z\zd"> [1>1]) = f° r ' ^ { u i v }- (The channel -Pgj^ is illustrated in Fig- 
ure | in Appendix A.) We show I(X;Y\Z) = E Z [I(X;Y\Z = z)] = 0, i.e., 
that I(X;Y\Z = u) = and I{X;Y\Z = v) = hold. By symmetry it is 
sufficient to show the first equality. For ay := P XYZ (i,j,u), we get 

aoo = (l-L>)(l-S)/2 , a n = (l-L>)o/2 , a i = a M = (D(l-S)/2+D5/2)/2 = D/4 . 

From equality in ^) we conclude aooon = aoiaiO! which is equivalent to the 
fact that X and Y are independent, given Z = u. 

Finally, note that the conditions (||) and (||) are equivalent for D € 
[0, 1/2]. This shows that the bounds of tolerable noise are indeed exactly 
the same for the quantum and classical scenarios. <0> 



Example 2. We consider the bound entangled state presented in [17|. This 



example received quite a lot of attention by the quantum-information com- 
munity because it was the first known example of bound entanglement (i.e., 
entanglement without the possibility of quantum key agreement). We show 
that its classical counterpart seems to have similarly surprising properties. 
Let < a < 1 and 



" \/^^V'®|0)+J^^^®|l) + J^ 1 -(|122)+|133)+|214)+|235)+|326)) , 



where^ = (|11)+|22)+|33))/V3 and <f> a = y/(l + a)/(2) |31) + v / (l - a)/(2) |33). 
It has been shown in [[l7|] that the resulting state pab is entangled. 

The corresponding classical distribution is as follows. The ranges are 
X = y = {1,2,3} andZ = {0,1,2,3,4,5,6}. We write (ijk) = P X Yz(i,j,k). 
Then we have (110) = (220) = (330) = (122) = (133) = (214) = (235) = 
(326) = 2a/(16a+2), (311) = (l+a)/(16a+2), and (331) = (l-a)/(16a+2). 
We study the special case a = 1/2. Consider the following representation 
of the resulting distribution (to be normalized). For instance, the entry 
"(0) 1 , (1) 1/2" for X = Y = 3 means P X yz(3,3,0) = 1/10 (normalized), 
Pxy^(3,3,1) = 1/20, and P X yz(3, 3, z) = for all z {0,1}. 
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X 


1 


2 


3 


Y(Z) 








1 


(0) 1 


(4) 1 


(1) 3/2 


2 


(2) 1 


(0) 1 


(6)1 


3 


(3) 1 


(5) 1 


(0)1 








(1) 1/2 



As we would expect, the intrinsic information is positive in this scenario. 
This can be seen by contradiction as follows. Assume I(X; Y[Z) = 0. Hence 
there exists a discrete channel, characterized by the conditional distribution 
P-Z\ Z , such that I(X;Y\Z) = holds. Let Z C N, and let i^, z (i,0) =: a*, 
Pz\ z (i,l) =: Xi, P^ z (i,6) = : Sj. Then we must have ai,Xi,Si E [0,1] and 
Yli a i = Yli x i = Yli s i = 1- Using I(X; Y|Z) = 0, we obtain the following 
distributions -f^v^i ^ e normalized): 



X 


1 


2 


3 


Y 








1 


ai 


3 CI i X i 

2si 


Sxi 
2 


2 


2dj Si 


ai 


Si 


3 


2a,i(ai+Xi/2) 
3xj 


a,i(a,i+Xi/2) 

Si 


ai + ^f 



By comparing the (2, 3)-entries of the two tables above, we obtain 

ai(ai + Xi/2) 



!2£ 



Si 



(6) 



We now prove that (^) implies Sj = a« (i.e., Sj = a, for all z) and Xj = 0. 
Clearly, this does not lead to a solution and is hence a contradiction. For 
instance, P XY ^2 =i {l,2) = 2ajSj/(3xj) is not even defined in this case if 
ai > 0. 

It remains to show that (||) implies ai = Sj and Xj = 0. We show that 
whenever Yli a i = Yli s i = 1 an d a i ^ s «> then ^j a ?/ s « > 1 • First, note 
that Yli a i/ S i = Yli a i = 1 f° r a « = s «- Let now < and Si 2 > a^. 
We show that a\j ' s ix + aj 2 /s i2 < 0^/(3^ - e) + aj 2 /(s i2 + e) holds for every 
e > 0, which obviously implies the above statement. It is straightforward 
to see that this is equivalent to af,Sj 2 (si 2 + e) > a^s^s^ — e), and holds 

£ 



because of af 1 Si 2 {Si 2 
the proof of I{X;Y{Z) > 0. 



+ ■:) > a? (ij, and a'fs i: (.s, 



< a? a? . This concludes 
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As mentioned, the interesting point about Example 2 is that the quan- 
tum state is bound entangled, and that also classical key agreement seems 
impossible despite the fact that I(X;Y\,Z) > holds. This is a contradic- 
tion to a conjecture stated in p2"j . The classical translation of the bound 
entangled state leads to a classical distribution with very strange properties 



as well! (See Example 2 (cont'd) in Section 3,4). 

In Example 3, another bound entangled state (first proposed in |l8|) is 
discussed. The example is particularly nice because, depending on the choice 
of the parameter a, the quantum state can be made separable, bound en- 
tangled, and free entangled. 

Example 3. We consider the following distribution (to be normalized). Let 
2 < a < 5. 



X 


1 


2 


3 


Y(Z) 








1 


(0)2 


(4) 5 - a 


(3) a 


2 


(1) a 


(0)2 


(5) 5 - a 


3 


(6) 5 - a 


(2) a 


(0)2 



This distribution arises when measuring the following quantum state. Let 
ij) := (1/V3) (|11) + |22) + |33)). Then 



^®|0>+J^(|12)®|1)+|23)®|2)+|31)®|3))+J^ 



(|21)®|4)+|32)<g>|5)+|13>®|6», 



and 



PAB = ^P^ + ^ (Pl2 + ^23 + Pu) + 



(P 21 + P 32 + P] 
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is separable if and only if a E [2, 3], bound entangled for a S (3, 4], and free 
entangled if a S (4, 5] |l8| (see Figure |3] in Appendix A). 

Let us consider the quantity I{X;Y { Z). First of all, it is clear that 
I{X- Y[Z) = holds for a G [2, 3]. The reason is that a>2and5-a>2 
together imply that Eve can "mix" her symbol Z = with the remaining 
symbols in such a way that when given that Z takes the "mixed value," 
then XY is uniformly distributed; in particular, X and Y are independent. 
Moreover, it can be shown in analogy to Example 2 that I{X;Y{ Z) > 
holds for a > 3. 



Examples 1, 2, and 3 suggest that the correspondence between separabil- 
ity and entanglement on one side and vanishing and non- vanishing intrinsic 
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information on the other always holds with respect to the standard bases or 
even arbitrary bases. We show in Appendix B that this is not true in gen- 
eral. More precisely, Examples 6 and 7 demonstrate how Eve as well as Alice 
and Bob can perform bad measurements. Hence the parallelity between the 
quantum and classical situation must be as it is stated in Theorems 1 and 2. 

3.3 A Classical Measure for Quantum Entanglement 

It is a challenging problem of theoretical quantum physics to find good 
measures for entanglement [p6[| . Corollary || above suggests the following 
measure, which is based on classical information theory. 

Definition 1 Let for a quantum state pab 



where the minimum is taken over all \& = y/p^ipz ® \z) such that P ab = 
Tr-}{ E (P^) holds and over all bases {\z)} of H.e, the maximum is over all 
bases {\x}} of TCa and {\y)} of TLb, and where Pxyz(x, y,z) := \ (x, y, z\^)\ 2 . 

O 

Then p has all the properties required from such a measure. If pab is 
pure, i.e., pab = \iPab)(iPab\, then we have in the Schmidt basis (see for 
example |§]) ip A B = Ej c j\ x jiVj) > and Kpab) = ~ Ej \ c j\ 2 lo g2(l c j| 2 ) = 
— Ti(pab log2 Pab), as it should |2~q] . It is obvious that p is convex, i.e., 



p(\ Pl + (1 - X)p 2 ) < A/i(pi) + (1 - X)p(p2). 

Example 4 (based on Werner's states). Let = V\ip(~^®\0)+y/(l - A)/4 |001+ 
012+103+114), where = |10-01)/\/2, and p A B = Ai^(-) + ((l-A)/4)l. 
It is well-known that pab is separable if and only if A < 1/3. Then the clas- 
sical distribution is (010) = (100) = A/2 and (001) = (012) = (103) = 
(114) = (1 - A)/4. 

If A < 1/3, then consider the channel (0,0) = P^ |z (2,2) = P^, z (3,3) = 



1, Pz ]z (0,l) = Pz\ z (0A) = £, ^|z(M) = Pz\z^^) = 1 where 
( = 2A/(1 - A) < 1. Then p(pab) = I{X;Y{Z) = I(X;Y\Z) = holds, as 



If A > 1/3, then consider the (obviously optimal) channel Pgj Z (0, 0) = 
iW2,2) = P^, z (3,3) = iW0,l) = iW0,4) = L Then 



>ab) '■= rnin ( max 

{\z)}\\x)},{\y)} 




it should. 



p(p AB ) = I(X; Y[Z) = I(X; Y\Z) = P ¥ (0)-/(X; Y\Z = 0) 



1 + A 

2 



■(l-q\og 2 q-(l-q) log 2 (l-g)) , 



where q = 2A/(1 + A). 



❖ 
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3.4 Classical Protocols and Quantum Privacy Amplification 



It is a natural question whether the analogy between entanglement and 
intrinsic information (see Section 3.1) carries over to the protocol level. The 
examples given in Section |3.5| support this belief. A quite interesting and 
surprising consequence would be that there exists a classical counterpart to 
bound entanglement, namely intrinsic information that cannot be distilled 
into a secret key by any classical protocol, if \X\ + \y\ > 5. In other words, 
the conjecture in [22| that such information can always be distilled would 
be proved for \X\ + |3^| < 5, but disproved otherwise. 



Conjecture 1 Let ^ G TLa ® TLb <8> He and pab = Tr^^i-^). Assume 
that for all generating sets {\z)} of He there are bases {\x)} and {\y)} of 
TLa and TLb, respectively, such that S(X;Y\\Z) > holds for the distribu- 
tion PxYz(x,y, z) := \(x, y, z\^}\ 2 . Then quantum privacy amplification is 
possible with the state pab, *.e. ; pab is free entangled. 



Conjecture 2 Let ^ £ TLa ® TLb <8> TLe and pab = Tr^ B (P^). Assume 
that there exists a generating set {\z)} of TLe such that for all bases {\x)} 
and {\y)} of TLa and TLb, respectively, S{X;Y\\Z) = holds for the distri- 
bution PxYz( x ,y, z) := | (x, y, z\^)\ 2 . Then quantum privacy amplification 
is impossible with the state pab, i-e., pab is bound entangled or separable. 



3.5 Examples II 

The following examples support Conjectures 1 and 2 and illustrate their 
consequences. We consider mainly the same distributions as in Section 3.2, 
but this time under the aspect of the existence of classical and quantum 
key-agreement protocols. 



Example 1 (cont'd). We have shown in Section 3^ that the resulting quan- 
tum state is entangled if and only if the intrinsic information of the cor- 
responding classical situation (with respect to the standard bases) is non- 
zero. Here, we show that such a correspondence also holds on the pro- 
tocol level. First of all, it is clear for the quantum state that QPA is 
possible whenever the state is entangled because both TLa and TLb have 
dimension two. On the other hand, the same is also true for the corre- 
sponding classical situation, i.e., secret-key agreement is possible whenever 
D/(l — D) < 2-\/ (1 — 5)5 holds, i.e., if the intrinsic information is positive. 
This is shown in Appendix C. There we describe the required protocol, more 
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precisely, the advantage-distillation phase (called repeat-code protocol p0[|), 
in which Alice and Bob use their advantage given by the authenticity of the 
public-discussion channel for generating new random variables for which the 
legitimate partners have an advantage over Eve in terms of the (Shannon) 
information about each other's new random variables. For a further discus- 
sion of this example, see also [15]. (} 



Example 2 (cont'd). The quantum state pab in this example is bound entan- 
gled, meaning that the entanglement cannot be used for QPA. Interestingly, 
but not surprisingly given the discussion above, the corresponding classical 
distribution has the property that I{X]Y[Z) > 0, but nevertheless, all the 



known classical advantage-distillation protocols EG], [22] fail for this distri 



bution! It seems that S(X; Y\\Z) = holds (although it is not clear how this 
fact could be rigorously proven, except by proving Conjecture 1 directly). 



Example 3 (cont'd). We have seen already that for 2 < a < 3, the quantum 
state is separable and the corresponding classical distribution (with respect 
to the standard bases) has vanishing intrinsic information. Moreover, it has 
been shown that for the quantum situation, 3 < a < 4 corresponds to bound 
entanglement, whereas for a > 4, QPA is possible and allows for generating 
a secret key ]l8|]. We describe a classical protocol here which suggests that 
the situation for the classical translation of the scenario is totally analogous: 
The protocol allows classical key agreement exactly for a > 4. However, this 
does not imply (although it appears very plausible) that no classical protocol 
exists at all for the case a < 4. 

Let a > 4. We consider the following protocol for classical key agree- 
ment. First of all, Alice and Bob both restrict their ranges to {1,2} (i.e., 
publicly reject a realization unless X £ {1, 2} and Y £ {1, 2}). The resulting 
distribution is as follows (to be normalized): 



X 

Y(Z) 


1 


2 


1 


(0)2 


(4) 5 - a 


2 


(2) a 


(0)2 



Then, Alice and Bob both send their bits locally over channels P%\x and 
Py\Y > respectively, such that the resulting bits X and Y are symmetric. The 
channel P X | X [iW] sends X = [F = 1] to X = 1 [F = 0] with probability 
(2a — 5) /(2a + 4), and leaves X [Y] unchanged otherwise. The distribution 
P-vvv is then 
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X 
Y (Z) 


1 


2 


1 


(0)2-^ 

f°l a 9 2a ~ 5 

\ ' 2a+4 2a+4 


(1) 5-a 

(2)«(iri) 2 
(0)2-2. i^f 


2 


(2)«(^)" 


(0)2-^ 

W " 2a+4 2a+4 



It is not difficult to see that for a > 4, we have Prob [X = Y] > 1/2 and 
that, given that X = K holds, Eve has no information at all about what 
this bit is. Thus the repeat-code protocol described in Appendix C allows 
for classical key agreement in this situation. For a < 4 however, classical 
key agreement, like quantum key agreement, seems impossible. The results 
of Example 3 are illustrated in Figure |3] in Appendix A. {> 



Example 5. The following distribution Pxyz, with binary X and Y, was 
discussed and analyzed in (2^] as an example of a simple distribution for 
which the equivalence of I(X;Y{Z) > and S(X;Y\\Z) > could not be 
shown. 

Assume that the random variables X and Y are distributed according 
to Pxy{0,0) = Pxy(M) = (1-«)A Pxy{0,1) = Pxy(1,0) = a/2, and 
Z = [Zx, Zy], where Zx and Zy are generated by sending X and Y over 
two independent binary erasure channels with erasure probabilities 5x and 
5y, respectively. 

If the conjectured parallels between classical and quantum protocols 
hold, then I(X;Y j Z) > implies S(X;Y\\Z) > because both X and 
Y are binary. Moreover, due to the proven connection between intrinsic 
information and entanglement and hence to the eigenvalues of the partial 
transpose of the density matrix, the condition for I(X;Y[ Z) > can be 
explicitly given, and is very simple. This is surprising since the determina- 
tion of I(X;Y I Z), as well as the advantage-distillation protocols for this 
distribution, turned out to be quite complicated |]22| . The condition under 
which all the eigenvalues of the partial transpose of the density matrix of 
the corresponding quantum state are non-negative is 

(a _ a ^(i-fc)(i-a y)+2 j ( (1 -fa)(i-fr )+2 j al 

This bound is compatible with (but stronger than) all the bounds painfully 
derived, by working purely in the classical information-theoretic world, in J22| |. 
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3.6 Bound Intrinsic Information 

Examples 2 and 3 suggest that, in analogy to bound entanglement of a 
quantum state, bound classical information exists, i.e., conditional intrinsic 
information which cannot be used to generate a secret key in the classical 
scenario. We give a formal definition of bound intrinsic information. 

Definition 2 Let P X yz be a distribution with I{X;Y\ Z) > 0. Then if 
,S(X;Y||Z) > holds for this distribution, the intrinsic information be- 
tween X and Y, given Z, is called free. Otherwise, if S(X;Y\\Z) = 0, the 
information is called bound. O 

Note that the existence of bound intrinsic information could not be 
proven so far. However, all known examples of bound entanglement, com- 
bined with all known advantage-distillation protocols, do not lead to a con- 
tradiction to Conjecture l! Clearly, it would be very interesting to rigor- 
ously prove this conjecture because then, all pessimistic results known for 
the quantum scenario would immediately carry over to the classical setting 
(where such results appear to be much harder to prove). 

Examples 2 and 3 also illustrate nicely what the nature of such bound 
information is. Of course, I(X;Y[ Z) > implies both I(X;Y) > and 
I(X;Y\Z) > 0. However, if \X\ + \y\ > 5, it is possible that the dependence 
between X and Y and the dependence between X and Y, given Z, are 
"orthogonal." By the latter we mean that for all fixed (deterministic or 
probabilistic) functions / : X — > {0, 1} and g ■ y ^ {0, 1} for which the 
correlation of f{X) and g(Y) is positive, i.e., 

P f(X)g(Y)(0,0) •P /(x)s(y) (l,l) > P f{x)g(Y) (0,l) ■ P f(x)gi Y)(l,0) , 

the correlation between the same binary random variables, given Z = z, is 
negative (or "zero") for all ~z £ Z, where Z is the random variable generated 
by sending Z over Eve's optimal channel P%\z- 

A complete understanding of bound intrinsic information is of interest 
also because it automatically leads to a better understanding of bound en- 
tanglement in quantum information theory. 

4 Concluding Remarks 

We have considered the model of information-theoretic key agreement by 
public discussion from correlated information. More precisely, we have com- 
pared scenarios where the joint information is given by classical random 
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variables and by quantum states (e.g., after execution of a quantum pro- 
tocol). We proved a close connection between such classical and quantum 
information, namely between intrinsic information and entanglement. As 
an application, the derived parallels lead to an efficiently verifiable criterion 
for the fact that the intrinsic information vanishes. Previously, this quantity 
was considered to be quite hard to handle. 

Furthermore, we have presented examples providing evidence for the fact 
that the close connections between classical and quantum information ex- 
tend to the level of the protocols. As a consequence, the powerful tools and 
statements on the existence or rather non-existence of quantum-privacy- 
amplification protocols immediately carry over to the classical scenario, 
where it is often unclear how to show that no protocol exists. In particular, 
many examples (only some of which are presented above due to space limi- 
tations) coming from measuring bound entangled states, and for which none 
of the known classical secret-key agreement protocols is successful, strongly 
suggest that bound entanglement has a classical counterpart: intrinsic in- 
formation which cannot be distilled to a secret key. This stands in sharp 
contrast to what was previously believed about classical key agreement. We 
state as an open problem to rigorously prove Conjectures 1 and 2. 

Finally, we have proposed a measure for entanglement, based on classical 
information theory, with all the properties required for such a measure. 
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Appendix A: Figures 
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Figure 1: Secret-Key Agreement from Common Information 
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Figure 2: The Channel P^\z i n Example 1 
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Figure 3: The Results of Example 3 



Appendix B: Measuring in "bad" Bases 

In this appendix we show, by two examples, that the statements of Theo- 
rems 1 and 2 do not always hold for the standard bases and, in particular, 
not for arbitrary bases: Alice and Bob as well as Eve can perform bad mea- 
surements and give away an initial advantage. Let us begin with an example 
where measuring in the standard basis is a bad choice for Eve. 

Example 6. Let us consider the quantum states 

* = -±= (|00+01+10)®|0)+|00+11>®|1)) , P ab = jjP|oo+oi+io>+ 1 ^|oo+ii) ■ 

If Alice, Bob, and Eve measure in the standard bases, we get the classical 
distribution (to be normalized) 



X 





1 


Y(Z) 









(0) 1 


(0) 1 




(1) 1 


(1)0 


1 


(0) 1 


(0)0 




(1)0 


(1) 1 



For this distribution, I(X;Y[Z) > holds. Indeed, even S(X;Y\\Z) > 
holds. This is not surprising since both X and Y are binary, and since the 
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described parallels suggest that in this case, positive intrinsic information 
implies that a secret-key agreement protocol exists. 

The proof of S(X; Y \ \Z) > in this situation is analogous to the proof of 
this fact in Example 3. The protocol consists of Alice and Bob independently 
making their bits symmetric. Then the repeat-code protocol can be applied. 

However, the partial-transpose condition shows that pab is separable. 
This means that measuring in the standard basis is bad for Eve. Indeed, let 
us rewrite VP and pab as 

^ = v^|m,m)<g>|0)+\/l - A|-m,-m)<g>|l) , p A B = — ^ — ^m,m)H ^7— P\-fh-rh) , 

where A = (5 + \/5)/10, \m,m) = \m) ® |m), | ± fh) = y^l ± rjj/2 |0) ± 
V(lTr/)/2|l), and 77 = 1/y/E. 

In this representation, pab is obviously separable. It also means that 
Eve's optimal measurement basis is 

|0) = VA|0)--i=|l), |1) = -v/T^A|0) - -j=L== |1) . 

Then, I(X;Y\,Z) = holds for the resulting classical distribution. 

Not surprisingly, there also exist examples of distributions for which mea- 
suring in the standard bases is bad for Alice and Bob. These states are 
entangled, but I(X;Y[Z) = holds. 



Example 7. Let the following classical distribution be given: 



X 





1 


Y(Z) 









(0) 0.0082 


(0) 0.0219 




(1) 0.0006 


(1) 0.0202 


1 


(0) 0.0729 


(0) 0.3928 




(1) 0.0905 


(1) 0.3889204545 



Because of 



(0.0082+0.0006)-(0.03928+0.3889204545) = (0.0219+0.0202)-(0.0729+0.0905) 

we have I(X;Y) = 0, thus I{X;Y [ Z) = 0. On the other hand, the 
corresponding quantum state, for which the above distribution results by 
measuring in the standard bases, can be shown to be entangled. 



26 



Appendix C: A Protocol for Advantage Distillation 



The following protocol for classical advantage distillation is called repeat- 
code protocol and was first proposed in pC| ]. Note that there exist more 
efficient protocols in terms of the amount of extractable secret key. However, 
since we only want to prove qualitative possibility results, it is sufficient to 
look at this simpler protocol. Assume the scenario of Example 1. 

Let iV > be an even integer, and let Alice choose a random bit C and 
send the block 

x N e c N -.= [x 1 ec,x 2 ec,...,x N e c\ 

over the classical channel. Here, X N stands for the block \X\, X2, • • • , -Xjv] of 
N consecutive realizations of the random variable X, whereas C N stands for 
the JV-bit block [C,C,...,C]. Bob then computes [(C Xx) Yi, . . . , (C © 
Xn) © Y/v] and (publicly) accepts exactly if this block is equal to either 
[0,0,..., 0] or [1,1,..., 1]. In other words, Alice and Bob make use of 
a repeat code of length N with the only two codewords [0, 0, ... , 0] and 
[1,1,..., 1]. 

Bob's conditional error probability /3jy when guessing the bit sent by 
Alice, given that he accepts, is 

1 / D x N 



Pa,N \1-D 

where p a ^ = D N + {1 — D) N is the probability that Bob accepts the received 
block. It is obvious that Eve's optimal strategy for guessing C is to compute 
the block [{C@X\)@Z\, . . . , (C®X N )®Z N \ and guess C as if at least half 
of the bits in this block are 0, and as 1 otherwise. Given that Bob correctly 
accepts, Eve's error probability when guessing the bit C with the optimal 
strategy is lower bounded by 1/2 times the probability that she decodes to 
a block with N/2 bits and the same number of l's. Hence we get that 

holds for some constant K and for sufficiently large N by using Stirling's 
formula. Note that Eve's error probability given that Bob accepts is asymp- 
totically equal to her error probability given that Bob correctly accepts be- 
cause Bob accepts erroneously only with asymptotically vanishing probabil- 
ity, given that he accepts. 
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Although it is not the adversary's ultimate goal to guess the bits C sent 
by Alice, it has been shown that the fact that (5m decreases exponentially 
faster than 77V implies that for sufficiently large N, Bob has more (Shannon) 
information about the bit C than Eve (see for example |22|]). Hence Alice 
and Bob have managed to generate new random variables with the property 
that Bob obtains more information about Alice's random bit than Eve has. 
Thus S{X-Y\\Z) > holds. 
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